Re: itp: static bins / resolving static debian issues
On Wed, Aug 18, 1999 at 04:00:48PM -0700, Steve Lamb wrote:
>
> >> > -- sash becomes an "important" package so that it is installed
> >> > by default. people who know that their systems will never
> >> > fail can deselect it, but by default you get it
> >>
> >> I don't think it should be forced on anyone as they may desire to go the
^^^^^^^^^^^^^^^^
> >> route of boot disks.
>
> > Read what I wrote.
>
> I did. "...so that it is installed by default." That means unless
> someone goes through and looks at each package installed they will not see it,
> it will be installed.
OK, then read what you wrote.
> If it is *required* make it *required*, if not, don't
> make it so it is installed unless the user is extremely diligent!
You need to read the debian policy document, in particular the definition
of "important". Marking something "important" doesn't force it on anyone,
it just means that if they do no extra work, they get it by default.
> That is the same as all of those mailing lists you get on because one
> company who requested your information placed a little box near small print
> that says, "If you don't want us to share this information, check here."
You're being ignorant now. Are you arguing that Debian should not have
an "important" designation, and that all the programs currently marked
that way should be moved to something else?
> >> > these are run so rarely I don't see why they can't be static
> >> > by default--but if people yell, we can have separate static
> >> > versions. ^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > ^^^^^^^^
> >>
> >> Static = bad. It is not up to you to determine how often things are run
> >> nor the relative "cheapness" of the hardware.
>
> > Read what I wrote.
>
> Again, I did. "...these are run so rarely I don't see why they can't be
> static..." I pointed out why. It is not up to you to determine how often
> something is or is not run.
OK, if you want to take your static emergency utilities and run them all
day long, rather than the dynamic versions available in /bin, you go and
do that. But if that costs you a lot of system resources, don't complain
about it, because you're doing something intentionally stupid.
> ...no command history. Those are the basic staples of an interactive
> shell. I think quite a few people would be pissed if you removed those from
> the root shell as that is what is generally ACCEPTED as STANDARD in an
> interactive shell.
However command history is not the definition of an interactive shell. I'm
sorry if you used the wrong word.
sash is in fact an interactive shell, and it can in fact be used
interactively. You may not like it, and may wish for a more featurefull
shell--but you can always invoke bash once sash is running. That does
work. So I don't see the problem.
If you really hate it, have two roots and have one of them have bash as
a shell and the other have sash.
Personally I would rather that root's shell were a static "ash", and that
all these other tools were available in /sbin. Then you could write a
simple .profile to invoke bash if it is available.
> > As for scripts which depend on root's shell: when was the last time you
> > ever saw a script that depended on roots shell? Short of root's own
> > .profile, I have never seen one, not once, ever.
>
> Again, that is not up to *YOU* to determine. *YOU* do not know what the
> local administrators do.
It would be extremely difficult for the local administrator to construct
syntax to do this. You're being obstinate now. Nobody has ever done this,
and nobody ever will, it's a non issue, so you should shut up about it.
Some of your other points had merit. This doesn't.
Anyone who writes a shell script that depends on knowing what roots
shell is, is an idiot.
> > I am not proposing that we use sash as /bin/sh! (Though I have previously
> > said that ash, which is also non-broken, I mean non-POSIX, might be
> > worth having as /bin/sh).
>
> And I agree with you on that. I have ash as sh here.
If it isn't static, you won't be able to get in as root when you need to.
I like having a static ash as roots shell, I would prefer that over sash,
and was only arguing the sash thing since it seemed more politically
likely to succeed.
>
> >> A better option is to make an alternative UID 0 user with sash that is not
> >> root. However, this introduces a security hole.
>
> > It introduces no security hole, and is a reasonable idea. (Or if it does
> > open a security hole, then there is a bug in Debian).
>
> The security hole is that if it is done authomatically a default password,
> which will have to be publicly know, has to be assigned to this new user.
Huh? Why can't it be the same as roots password? I don't understand. And
you would never make it a default well known password unless you were just
really stupid--the only sensible default password, in the absence of the
user specifying one (which in fact they do, during the install) is to
use "*" as the default password.
> Now, couple that with your idea of forcing the install on the ignorant and you
> now have a problem where a publicly known password to a root shell is on a
> machine that people may not know about. Furthermore it adds complexity in
> that the person now has to change two account's passwords to keep root secure.
> That isn't a bug, but that is a security problem.
The extra password to change is an issue. But since there is no good reason
why you wouldn't have a static ash as roots shell, this whole line is is
moot anyway.
If you are spending all day long running commands as root, spend the
extra 1 second to type "bash" and stop complaining.
>
> > However, I have always been in favour of root having a shell without
> > command history and such, since it discourages people from using
> > root unless they have to.
>
> Thus making work when you do need to use it more difficult, harder to
> perform, waste time. Brilliant!
You can always type "bash" or have a .profile that runs bash, so I
really just don't see your point at all. If dynamic linking is working,
you can get bash going; if it isn't working, you're glad you didn't have
something dynamic as your shell!
You just aren't making any sense.
> No, it has been that in the majority of the cases it is not needed, that
> it is the domain of the local administrator to take such precautions, that
> forcing these changes into Debian proper, you are forcing problems onto every
> Debian install to satisfy a *perceived* problem which has multiple answers and
> trade-offs that ONLY the individual administrators should make decisions on!
Once again you are just saying all this, re-read what you just wrote and
note that it is all just opinion.
>
> Truth be known I installed sash as soon as I heard of it because I
> recognized the value of it. That is *MY* decision and not one that I would
> force on every Debian system unilaterally!
Nobody will be forced to install it. Just when people get lazy and say,
"go ahead and install the usual stuff", they will get it. If you really
were short on disk space you could selectively choose your packages and
leave it out--99.9% of Debian users are not short of disk space and
won't have to or want to do that. The 0.1% who are short on disk space,
or long on anti-static religion, can choose not to have it.
> I do see limited value in static
> binaries, but not in a unilateral manner since it is only useful in a *VERY*
> small segment while being DETRIMENTAL in the vast majority!
That's a very controversial thing to say--in what way would it be
"detrimental" to the majority? Go back and read all the posts where I
argued against the notion that it costs anything other than disk space
before you answer.
The vast majority of Debian users can afford the disk space; the very tiny
small number who can't can choose not to install it.
> I prefer ash to
> bash as /bin/sh because it is smaller, faster, and is not an interactive shell
> with all the associated overhead. Using it as default saves systems
> resources, speeds up systems and really harms nothing. That is not the case
> with your proposal at all.
I prefer ash as /bin/sh as well, a statically linked one. I only argued for
sash because it seemed more popular here, and I figured it was a reasonable
compromise. If you are happier with a static ash as /bin/sh, then let's
agree on that.
Justin
Reply to: